Open Source Is Not Community Ownership: A Governance Field Guide for Forum Admins

Open source is a licensing regime, not a governance model. When Discourse or NodeBB publishes its source under a GPL-family license, you gain the right to read, modify, and redistribute that code. You gain no right to decide what the code becomes next, who merges changes, or what happens when the lead maintainer accepts a job offer elsewhere. Community ownership is a separate question, settled by trademarks, commit access, contributor agreements, and whoever signs the maintainers’ paychecks. Forum administrators who treat the two as the same thing make a ten-year commitment on the strength of a file they have never opened. This guide separates the license from the ledger, platform by platform, so your next migration is a decision rather than an eviction.

I write this as someone who has moved three communities past 10,000 members between platforms and archived a fourth that asked the ownership question too late. In every case, the license was fine. The governance was the problem.

What the License Actually Grants You

The Open Source Initiative’s Open Source Definition is a set of distribution terms: available source, free redistribution, no discrimination against persons or fields of endeavor. It is a contract about the artifact you downloaded. It says nothing about the artifact you will need in five years.

Read the license as answering one question: what may I legally do with the code I have? It does not answer who sets the roadmap, who holds the trademark, who can relicense future versions, who holds commit access, or who funds security releases. Those are governance questions, and they live in different documents — or, in most projects, nowhere at all. A license is a promise about the past. Governance is the machinery that produces your future.

The Five Assets That Decide Who Owns a Project

When I audit forum software before a client commits to it, I look past the LICENSE file at five assets. Every surprise migration I have been hired to rescue traces back to one of them.

1. The trademark. You can fork the code, but you cannot fork the name. MariaDB and OpenTofu survived renaming because companies funded the rebrand; plugin authors search for the old name, and search engines remember it even longer.
2. The repository and its infrastructure. Who administers the source control organization, the build servers, the package registry, and the update endpoints? If the update server belongs to a company, your admin panel’s upgrade button is a courtesy that company extends.
3. Commit access. Count the accounts that can merge changes, then check who employs them. If the list reduces to one company, you are running a vendor’s product that happens to be public.
4. The contributor license agreement. The CLA decides whether the steward can relicense the codebase — including patches you donated — under different terms later. It outranks the license in practice, and almost nobody reads it.
5. The money and the entity. Is there a non-profit, a company, or one person’s bank account behind the project? A donate button is a tip jar, not a governance document. It funds coffee; it does not fund succession.

The Forum Landscape, Sorted by Ownership

The platforms this site covers sort cleanly once you stop reading their front pages and start reading their filings.

phpBB: the closest thing to a commons

phpBB is stewarded by phpBB Limited, a UK-registered non-profit, developed by volunteers, and released under the GPL-2.0. The structure is genuine, and its price is visible: the release cadence runs on volunteer hours, and the 4.0 line has been in development for years. You get transparency and a slow train. That is a fair trade for some communities and an unacceptable one for others, but at least the fare is posted on the wall.

Discourse: vendor governance with the lights on

Discourse is developed by Civilized Discourse Construction Kit, Inc. The repository is public under the GPL-2.0, and the same company sells hosting and enterprise support. Contributions are welcome; the roadmap, the trademark, and the merge button are not shared. This is a workable arrangement — it pays for full-time security work — but call it what it is: a company whose product is developed in public, not a commons.

NodeBB: the same shape, smaller

NodeBB Inc. develops GPL-3.0 software and sells hosted instances. The audit questions are identical to Discourse’s, and so are the answers.

vBulletin and the hosted platforms: honest about the deal

vBulletin, owned by Internet Brands, is proprietary, and so is every ProBoards-style hosted forum. There is something almost restful about that: nobody pretends. Your bargaining power is your data export and your renewal date, and the contract at least defines what breach looks like. The governance question collapses into a contract question — a downgrade in flexibility, an upgrade in clarity.

The CLA Is the Real Constitution

A contributor license agreement decides whether “open” is a permanent condition or a current policy. Under a typical CLA, contributors grant the steward the right to relicense the aggregate codebase. That is how projects that spent a decade accepting outside patches changed licenses overnight: Elastic moved away from Apache 2.0 in 2021, and HashiCorp moved its products to the Business Source License in 2023. Nothing illegal happened. The paperwork had said all along whose code it was.

The counter-case is instructive. When HashiCorp relicensed Terraform, the community answer was OpenTofu: a fork of the last MPL-2.0 release, renamed, rebranded, and seated under the Linux Foundation with a consortium of vendors paying the bills. That is what a fork costs. Your forum’s donation drive cannot fund it. A fork is not an exit; it is a startup with a grudge.

Before you donate a patch to your platform, read its contribution terms. If a CLA grants one company relicensing rights, you are doing unpaid research and development under an option agreement. Some of us have signed anyway. Know which document you are signing.

What Community Ownership Would Actually Require

Genuine community ownership is a legal and economic structure, not a sentiment. It needs, at minimum: a legal entity holding the trademark and the funds; a documented succession process; several maintainers who do not share an employer; decisions made in public; and contribution terms that do not concentrate relicensing rights in one set of hands. Almost nothing clears that bar, because the bar is expensive.

The honest version in forum software looks like phpBB’s non-profit, and even there, governance rests with a small leadership team, not with the thousands of admins running copies on shared hosting. Community ownership of the software was never on the menu for you. What you own is your data, your member relationships, and your operational choices. Protect those, and the software question becomes negotiable.

A Governance Audit You Can Run in an Afternoon

Before your next platform decision, run this checklist. It has saved my clients five-figure migration budgets, and it costs less time than one plugin conflict.

1. Read the LICENSE file and the contribution terms. They answer different questions, and the second matters more.
2. Identify the trademark holder through a register search. If the mark sits with a company, assume the roadmap does too.
3. Count committers with merge rights and note their employers. One employer equals one roadmap.
4. Review two years of release history and security-response times, not the roadmap page. Roadmaps are marketing with dates attached.
5. Identify the legal entity behind the project — non-profit, company, or individual. Each fails differently, and you should know which failure mode you are renting.
6. Price your exit before you enter: export formats, attachment handling, plugin lock-in. Our field notes on forum data export formats and legacy vBulletin migrations cover the mechanics.

Frequently Asked Questions

Is phpBB community-owned?

Closest to it in this market: a UK-registered non-profit, volunteer development, GPL-2.0 code. Governance still rests with its leadership team rather than with the admins who deploy it, and the release cadence reflects unpaid hours. It is the honest end of the spectrum, not a utopia.

Is Discourse open source?

Yes — GPL-2.0 code, developed in public — and it is also company-owned. Those are different axes. A project can be one, both, or neither, and Discourse is deliberately both.

Can a company take an open source project closed?

Existing releases keep their license forever. Future releases can change terms where a CLA grants relicensing rights, as Elastic and HashiCorp demonstrated. Your practical mitigations are the last open release and the fork you can afford, which is usually none.

What does open core mean for forum admins?

The core is open; the features you actually need at 10,000 members — single sign-on connectors, theming support, moderation tooling — sit behind a commercial license. The model is legitimate and common, but audit the paywall before committing. The free tier is a sample, not a product.

Does self-hosting mean I own my forum?

You own the server, the data, and the pager. You still depend on upstream for security patches and plugin updates, and on your own discipline for backups. Self-hosting relocates risk; it does not delete it.

The Working Rule

Read the license to learn what you may do with the software you have. Read the governance to learn what the software will do to you. Choose platforms the way a careful tenant chooses a building: the lease matters, but who holds the deed and whether they answer email matters more. Communities of 10,000 or more members outlive most of the software they run on. Plan for the day the repository goes quiet — not with dread, just with a saved export and a shortlist. That is the whole difference between a community that migrates and a community that gets migrated.